registry / @plugdev/cli / 0.10.0

@plugdev/cli@0.10.0

Test Minecraft plugins in one command — plug / plugdev CLI (Paper, Folia, Purpur, Pufferfish, Spigot)

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 258 KB of source, external domains: adoptium.net, api.modrinth.com, fill.papermc.io, github.com, hangar.papermc.io, nodejs.org, piston-meta.mojang.com

Source & flagged code

6 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import {

3 findJarByPattern,

4 pomHasModules,

5 runMavenBuild

6} from "./chunk-FWT7K2FI.js";

7import {

8 Errors,

9 PlugDevError,

10 formatError,

11 formatErrorJson,

12 getExitCode

13} from "./chunk-ZRAF2YOM.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L11

14import {

15 loadDotEnv,

16 resolveBotTokenEnv

17} from "./chunk-2AEF77LC.js";

18import {

19 depSearchTerms,

20 installDeps,

21 prefetchDeps

22} from "./chunk-OLHJM7QV.js";

23import {

24 DEFAULT_COMPAT_DEPS,

25 DEP_PRESETS,

26 hasViaCompatDeps

27} from "./chunk-BNG52FQ3.js";

28import {

29 CLI_VERSION,

30 FILL_API_BASE,

31 USER_AGENT,

Lines 1108-1148javascript

1108function embeddedClientDir() {

1109 return join10(plugdevHome(), "minecraft");

1110}

1111async function isEmbeddedClientCached(mcVersion) {

1112 const versionJson = join10(

1113 embeddedClientDir(),

•matchType = previous_version_dangerous_delta matchedPackage = @plugdev/cli@0.8.0 matchedIdentity = npm:QHBsdWdkZXYvY2xp:0.8.0 similarity = 0.455 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 17374 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 17374 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 17374 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

Source & flagged code

6 flagged · loading source

dist/cli.jsView file

1128package = @plugdev/cli; repositoryIdentity = plugdev; dependency = @xmcl/core L1128: try { L1129: const { diagnose } = await import("@xmcl/core"); L1130: const report = await diagnose(mcVersion, embeddedClientDir());

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L1128

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

11formatErrorJson, L12: getExitCode L13: } from "./chunk-ZRAF2YOM.js"; ... L277: if (result.type === "unknown") { L278: const pkgRaw = await readText(join(cwd, "package.json")); L279: if (pkgRaw) { L280: try { L281: const pkg = JSON.parse(pkgRaw); L282: const deps = { ... L453: // src/util/tools.ts L454: import { execa } from "execa"; L455: import { join as join3 } from "path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L11

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 17374 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 17374 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 17374 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

Findings

3 High4 Medium7 Low

HighCopied Package Dependency Bridgedist/cli.js

HighShips High Entropy Blobbootstrap/plugdev-bootstrap-paper.jar

HighPrevious Version Dangerous Deltadist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbootstrap/plugdev-bootstrap-paper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionbootstrap/plugdev-bootstrap-paper.jar

Source & flagged code

6 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import {

3 findJarByPattern,

4 pomHasModules,

5 runMavenBuild

6} from "./chunk-FWT7K2FI.js";

7import {

8 Errors,

9 PlugDevError,

10 formatError,

11 formatErrorJson,

12 getExitCode

13} from "./chunk-ZRAF2YOM.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L11

14import {

15 loadDotEnv,

16 resolveBotTokenEnv

17} from "./chunk-2AEF77LC.js";

18import {

19 depSearchTerms,

20 installDeps,

21 prefetchDeps

22} from "./chunk-OLHJM7QV.js";

23import {

24 DEFAULT_COMPAT_DEPS,

25 DEP_PRESETS,

26 hasViaCompatDeps

27} from "./chunk-BNG52FQ3.js";

28import {

29 CLI_VERSION,

30 FILL_API_BASE,

31 USER_AGENT,

Lines 1108-1148javascript

1108function embeddedClientDir() {

1109 return join10(plugdevHome(), "minecraft");

1110}

1111async function isEmbeddedClientCached(mcVersion) {

1112 const versionJson = join10(

1113 embeddedClientDir(),

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 17374 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 17374 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 17374 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg